# 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions

TeamPCP force-pushed malicious commits to 76 of 77 aquasecurity/trivy-action version tags, injecting a credential stealer that read secrets from Runner.Worker memory and exfiltrated them to a typosquat C2 domain.

- Payout: Real-world hack
- Severity: critical
- Program: aquasecurity/trivy-action
- Analysis by: StepSecurity
- Disclosed: 2026-07-02
- CVE: CVE-2026-33634
- Write-up quality: 6/10
- Original: https://www.stepsecurity.io/blog/10-layers-deep-how-stepsecurity-stops-teampcps-trivy-supply-chain-attack-on-github-actions
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-10-layers-deep-how-stepsecurity-stops-teampcps-trivy-supply-chain-attack-on-github-actions
- Tags: area:oss domain:oss impact:data-leak impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:github-actions technique:recon technique:source-review vuln:secrets-leak

**Target:** GitHub Actions composite action (trivy-action) and GitHub-hosted/ARC runners
**Root cause:** Attacker gained write access to the trivy-action repository and force-pushed malicious commits onto 76 existing version tags (v0.0.1–v0.34.2), so any workflow referencing a mutable tag silently executed attacker code. The injected payload spawned a Python process that read /proc/pid/mem of the Runner.Worker process to harvest marked secrets from memory.
**Steps:**
1. Fork the aquasecurity/trivy-action repository and push malicious commits to the fork (imposter commits reachable by SHA but on no branch of the source repo).
2. Force-push the original repository's tags v0.0.1 through v0.34.2 to point at the fork commits, so `aquasecurity/trivy-action@v0.30.0` (and other tag refs) resolve to attacker code.
3. Injected payload spawns a Python process that reads `/proc/pid/mem` of the `Runner.Worker` process to extract marked secrets from memory.
4. Harvest environment variables and secrets, then POST them to the C2 `scan.aquasecurtiy.org` (typosquat, resolving to `45.148.10.212`).
**How found:** StepSecurity's AI agent monitors the GitHub Actions ecosystem for unusual tag activity, suspicious commit patterns and community reports; it flagged the anomalous tag rewrites, the team reverse-engineered the malware, and runtime monitoring caught the anomalous egress to scan.aquasecurtiy.org and the /proc/pid/mem read of Runner.Worker.
**Exploitation:** Any workflow referencing a mutable trivy-action tag (e.g. `aquasecurity/trivy-action@v0.30.0`) executed the attacker's code on the runner. The payload read secrets directly out of the Runner.Worker process memory via /proc/pid/mem and exfiltrated them over HTTPS to the attacker-controlled typosquat domain scan.aquasecurtiy.org (45.148.10.212). Compromise window began March 19, 17:43 UTC.
**Escalation:** Same playbook reused days later against Checkmarx KICS GitHub Action (malware in all Git tags); TeamPCP also linked to PyPI litellm and telnyx and CanisterWorm npm campaigns, scaling credential theft across the software supply chain.
**Insight:** Mutable action tags are a supply-chain attack surface: an attacker with repo write can force-push tags to imposter commits that resolve by SHA but sit on no branch. Detect by resolving each action ref to a SHA and checking it is reachable from a branch of the source repo, and pin to full commit SHAs.